Microsoft MSRC Replaces Bug Bounty Report Quality Tiers With 'Complete' and 'Not Complete' Assessments Affecting Rewards
Microsoft Security Response Center (MSRC) announced on October 20, 2026 that it is replacing the multiple report quality levels in its bug bounty programs with two assessments: "Complete" and "Not Complete". The rules apply to reports submitted on or after October 20, 2026, 8 AM Pacific Time. Earlier submissions remain under the previous requirements. Reports rated "Complete" may receive higher bounty rewards than "Not Complete" ones. Completeness is evaluated separately from severity, scope and payment eligibility. This is a program policy change, not a threat or vulnerability disclosure.
Technical Details
- A "Complete" report must include clear reproduction steps, a reliable and minimal proof of concept, the vulnerability type, and technical analysis with the root cause where possible.
- It must also state the affected environment, platform, versions and component, and explain exploitability (attacker position, prerequisites, trigger conditions) and impact.
- Supporting artifacts vary by product and vulnerability class. They include crash dumps, Time Travel Debugging traces, call stacks, proof-of-concept source code, Process Monitor logs, packet captures and video demonstrations.
- For on-premises products, memory corruption and denial of service findings may need crash data, call stacks and PoC source. File redirection reports may need Process Monitor logs, and NTLM coercion and relay reports may need packet captures. Web application reports can include videos and scripts.
- AI vulnerability reports must still follow Microsoft's published AI reporting guidelines.
- Completeness is judged on the initial submission. Later clarifications should not be assumed to establish it.
Remediation
- Researchers should include reproducible findings, accurate analysis and vulnerability-specific artifacts in the initial submission.
- Researchers should consult the applicable program requirements rather than relying on a generic report template.
Linha do tempo
-
Microsoft MSRC Replaces Bug Bounty Report Quality Tiers With 'Complete' and 'Not Complete' Assessments Affecting Rewards
ler a análise desta fonte ocultar
Microsoft Security Response Center (MSRC) announced on October 20, 2026 that it is replacing the multiple report quality levels in its bug bounty programs with two assessments: "Complete" and "Not Complete". The rules apply to reports submitted on or after October 20, 2026, 8 AM Pacific Time. Earlier submissions remain under the previous requirements. Reports rated "Complete" may receive higher bounty rewards than "Not Complete" ones. Completeness is evaluated separately from severity, scope and payment eligibility. This is a program policy change, not a threat or vulnerability disclosure.
Technical Details
- A "Complete" report must include clear reproduction steps, a reliable and minimal proof of concept, the vulnerability type, and technical analysis with the root cause where possible.
- It must also state the affected environment, platform, versions and component, and explain exploitability (attacker position, prerequisites, trigger conditions) and impact.
- Supporting artifacts vary by product and vulnerability class. They include crash dumps, Time Travel Debugging traces, call stacks, proof-of-concept source code, Process Monitor logs, packet captures and video demonstrations.
- For on-premises products, memory corruption and denial of service findings may need crash data, call stacks and PoC source. File redirection reports may need Process Monitor logs, and NTLM coercion and relay reports may need packet captures. Web application reports can include videos and scripts.
- AI vulnerability reports must still follow Microsoft's published AI reporting guidelines.
- Completeness is judged on the initial submission. Later clarifications should not be assumed to establish it.
Remediation
- Researchers should include reproducible findings, accurate analysis and vulnerability-specific artifacts in the initial submission.
- Researchers should consult the applicable program requirements rather than relying on a generic report template.